open-consul/agent/connect
Matt Keeler baa89c7c65
Intentions ACL enforcement updates (#7028)
* Renamed structs.IntentionWildcard to structs.WildcardSpecifier

* Refactor ACL Config

Get rid of remnants of enterprise only renaming.

Add a WildcardName field for specifying what string should be used to indicate a wildcard.

* Add wildcard support in the ACL package

For read operations they can call anyAllowed to determine if any read access to the given resource would be granted.

For write operations they can call allAllowed to ensure that write access is granted to everything.

* Make v1/agent/connect/authorize namespace aware

* Update intention ACL enforcement

This also changes how intention:read is granted. Before the Intention.List RPC would allow viewing an intention if the token had intention:read on the destination. However Intention.Match allowed viewing if access was allowed for either the source or dest side. Now Intention.List and Intention.Get fall in line with Intention.Matches previous behavior.

Due to this being done a few different places ACL enforcement for a singular intention is now done with the CanRead and CanWrite methods on the intention itself.

* Refactor Intention.Apply to make things easier to follow.
2020-01-13 15:51:40 -05:00
..
ca connect: derive connect certificate serial numbers from a memdb index instead of the provider table max index (#7011) 2020-01-09 16:32:19 +01:00
common_names.go connect: Add AWS PCA provider (#6795) 2019-11-21 17:40:29 +00:00
csr.go Make all Connect Cert Common Names valid FQDNs (#6423) 2019-11-11 17:11:54 +00:00
generate.go connect: Support RSA keys in addition to ECDSA (#6055) 2019-07-30 17:47:39 -04:00
generate_test.go Fix support for RSA CA keys in Connect. (#6638) 2019-11-01 13:20:26 +00:00
parsing.go Fix support for RSA CA keys in Connect. (#6638) 2019-11-01 13:20:26 +00:00
sni.go connect: generate the full SNI names for discovery targets in the compiler rather than in the xds package (#6340) 2019-08-19 13:03:03 -05:00
sni_test.go connect: generate the full SNI names for discovery targets in the compiler rather than in the xds package (#6340) 2019-08-19 13:03:03 -05:00
testing_ca.go Make all Connect Cert Common Names valid FQDNs (#6423) 2019-11-11 17:11:54 +00:00
testing_ca_test.go Fix support for RSA CA keys in Connect. (#6638) 2019-11-01 13:20:26 +00:00
testing_spiffe.go Fixed many tests after rebase. Some still failing and seem unrelated to any connect changes. 2018-06-14 09:42:16 -07:00
uri.go tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597) 2019-06-27 22:22:07 +02:00
uri_agent.go tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597) 2019-06-27 22:22:07 +02:00
uri_agent_test.go tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597) 2019-06-27 22:22:07 +02:00
uri_service.go Intentions ACL enforcement updates (#7028) 2020-01-13 15:51:40 -05:00
uri_service_test.go Intentions ACL enforcement updates (#7028) 2020-01-13 15:51:40 -05:00
uri_signing.go fix typos reported by golangci-lint:misspell (#5434) 2019-03-06 11:13:28 -06:00
uri_signing_test.go Fixed many tests after rebase. Some still failing and seem unrelated to any connect changes. 2018-06-14 09:42:16 -07:00
uri_test.go tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597) 2019-06-27 22:22:07 +02:00